Knowledgebase business article search

Knowledgebase Search

How do I configure my Cyberoam® (a Sophos company) UTM device for use with ESET Secure Authentication?

Applies to: ESET Secure Authentication

Solution

Introduction

This article describes how to configure a Cyberoam® UTM appliance to authenticate users against an ESA Server. Cyberoam® SSL VPN, Captive Portal and IPsec VPN applications are supported. Before proceeding, verify that you've installed the RADIUS Server component of ESET Secure Authentication and can access the RADIUS service that allows external systems to authenticate users.

Before your Cyberoam® device can use the ESA Server to authenticate users via RADIUS, it must be set up as a RADIUS client on the ESA Server. Next, your server running the ESA RADIUS service must be setup as a RADIUS Server on the Cyberoam® device. Once these configurations have been specified, you can start logging into your Cyberoam® device using ESA OTPs.

NOTE:

This integration guide utilizes VPN does not validate AD user name and password VPN type for this particular VPN appliance. If you wish to utilize other VPN type, refer to generic description of VPN types and verify with the vendor if the VPN appliance supports it.

Step I - RADIUS client configuration

To allow the Cyberoam® device to communicate with your ESA Server, you must configure the device as a RADIUS client on your ESA Server:

Launch the ESA Management Console (found under Administrative Tools).

Navigate to RADIUS Servers and locate the hostname of the server running the ESA RADIUS service.

Right-click the hostname and select Add Client from the context menu.

Configure a RADIUS client (see Figure 1-1).

Click OK - you will be prompted to restart the RADIUS Service, do so from the Services control panel.

Configuring your RADIUS client

To prevent locking any existing, non-2FA enabled AD users out of your VPN we recommend that you allow Active Directory passwords without OTPs during the transitioning phase. It is also recommended that you limit VPN access to a security group (for example VPNusers).

Make sure that the check box next to Compound Authentication is selected.

Figure 1-1

ESA has now been configured to communicate with the Cyberoam® device. You must now configure the Cyberoam® device to communicate with the ESA Server.

Click Test Connection. Enter the credentials of your test user. Make sure that you are using a user with Mobile Application 2FA using ESA enabled. When prompted for a password, append the OTP generated by the ESA Mobile Application to your AD password. For example, if the user has an AD password of Esa123 and an OTP of 999111, you should type Esa123999111.

Click on Test Connection. You should see a success status message in the bottom left, (see Figure 2-2). Do not proceed to Step III until the connectivity test is successful.

Figure 2-2

Step III - Enable ESA Authentication

In the left panel, navigate to Identity → Authentication → VPN.

Configure the relevant VPN Authentication Methods. For example, for SSL VPN Authentication, select "ESA RADIUS" as the authentication method, as per Figure 3-1.

Click Apply, then OK.

Figure 3-1

Step IV - Test the connection

To test the newly configured connection:

Navigate to your sign-in page.

Enter the following credentials using your test account:

AD username in the Username field.

AD password, concatenated with an OTP from their ESA Mobile application in the Password field.

Troubleshooting

If you are unable to authenticate via the ESA RADIUS server, make sure that you have performed the following steps: